Multi-level autonomous integrity monitoring method for multi-source PNT resilient fusion navigation

Abstract

For the integrity monitoring of a multi-source PNT (Positioning, Navigation, and Timing) resilient fusion navigation system, a theoretical framework of multi-level autonomous integrity monitoring is proposed. According to the mode of multi-source fusion navigation, the framework adopts the top-down logic structure and establishes the navigation source fault detection model based on the multi-combination separation residual method to detect and isolate the fault source at the system level and subsystem level. For isolated non-redundant navigation sources, the system level recovery verification model is used. For the isolated multi-redundant navigation sources, the sensor fault detection model optimized with the dimension-expanding matrix is used to detect and isolate the fault sensors, and the isolated fault sensors are verified in real-time. Finally, according to the fault detection and verification results at each level, the observed information in the fusion navigation solution is dynamically adjusted. On this basis, the integrity risk dynamic monitoring tree is established to calculate the Protection Level (PL) and evaluate the integrity of the multi-source integrated navigation system. The autonomous integrity monitoring method proposed in this paper is tested using a multi-source navigation system integrated with Inertial Navigation System (INS), Global Navigation Satellite System (GNSS), Long Baseline Location (LBL), and Ultra Short Baseline Location (USBL). The test results show that the proposed method can effectively isolate the fault source within 5 s, and can quickly detect multiple faulty sensors, ensuring that the positioning accuracy of the fusion navigation system is within 5 m, effectively improving the resilience and reliability of the multi-source fusion navigation system.

Introduction

The construction of an integrated Positioning, Navigation, and Timing (PNT) system has become a national strategy. The resilient PNT technology is the only way to realize the integrated PNT and has become an area of the international competition of PNT. There are many redundant PNT sensors available in the same application scenario or application carrier, but how to provide high precision, high reliability, and high anti-interference navigation services for the carrier in a complex application environment is a key issue. In practical applications, any navigation source has errors and faults due to harsh environments, human interference, and hardware aging. If these errors and faults are not detected in time, the entire navigation system will be affected, which will lower the navigation accuracy and even cause the failure of the entire navigation system (Groves, 2016; Yang, 2018).

The concept of navigation system integrity monitoring originates from the field of Safety of Life (SOL), which is to measure the confidence of the information provided by the navigation system. The integrity also includes the ability to timely alert users when the navigation system does not provide trusted services (Zabalegui et al., 2020; Zhu et al., 2018). Early integrity monitoring focuses on the Global Navigation Satellite System (GNSS), which is mainly used to monitor the failure of satellites, the receiver hardware, or the distortion of space signals. Receiver Autonomous Integrity Monitoring (RAIM) has been widely used.

The traditional RAIM algorithm usually uses the snapshot method based on the least square estimation to detect the single fault. With the deployment of multiple constellations, new RAIM methods have emerged. The Advanced RAIM (ARAIM) algorithm uses the multi-solution separation method in the location domain to realize multi-fault detection (Blanch et al., 2012; GEAS, 2008; GEAS, 2010). The RAIM algorithm based on Kalman Filter (KF-RAIM) realizes fault detection according to the difference between the predicted value and the measured value provided by the filter, and the detection ability of soft fault is poor (Madrid, 2016). In addition to the RAIM algorithm which uses pseudorange measurements, some scholars also use carrier phase measurements to realize GNSS integrity monitoring. The Carrier RAIM (CRAIM) algorithm detects the fault of the carrier phase by using the w-detection. However, the method can only complete failure detection, but does not provide failure identification (Feng et al., 2009). The Relative RAIM (RRAIM) algorithm estimates the new position by using the difference between the accumulated carrier phase and the original value, and regularly performs fault detection based on the solution separation RAIM method (Lee, 2011). Furthermore, the RAIM algorithm can be applied to time services. The Time RAIM (TRAIM) algorithm detects and removes the satellites whose time residuals exceed a previously defined threshold (Gioia et al., 2017).

With the development of navigation technology, navigation sensor or system such as GNSS, Inertial Navigation System (INS), barometer, Light Detection and Ranging (LiDAR), magnetometer, etc. have been widely applied. Multi-source PNT resilient fusion navigation technology is the only way to improve the continuity, reliability, and accuracy of the navigation system. Therefore, it is urgent to expand RAIM algorithm for multi-source PNT fusion navigation system. A multi-sensor integrity management model was proposed, which can detect and isolate faulty sensors by constructing parallel subfilters (Jurado et al., 2019; Jurado et al., 2020, 2021). However, this method only realized fault detection at the sensor level, and the parallel subfilters needed to be initialized when multiple fault detection is carried out, which easily leads to fault detection delay and affects the reliability of the system. For the fault detection of a fusion navigation system using federated filtering, the fault navigation source is detected by using fuzzy logic and weighted residual eigenvalues, and the federated fusion coefficient is adjusted (Cong, 2021; Cui et al., 2021; Yang, 2017). However, this method only realizes the Fault Detection and Isolation (FDI) of navigation sources at the subsystem level, and the number of subfilters that the system needs to establish will also increase with the increase of the number of navigation sources. In addition, most of the multi-source fusion navigation systems use Kalman Filter to achieve fusion estimation, and the KF filter has a poor ability to detect soft faults. Another method is to use the Kalman Filter with the Least Square (KF-LS) form to construct a multi-solution separation method in the position domain. (Joerger et al., 2013; Hewitson et al., 2010; Meng et al., 2021). However, the observation error of a single navigation source is affected by redundant navigation sources and easily submerged in the process of state calculation, resulting in missing detection.

The current integrity monitoring methods of the multi-source fusion navigation system mainly use the fault detection methods of traditional GNSS and focus on the single-level mode at the sensor level or subsystem level. The multi-source fusion navigation system itself has a variety of combined working modes and redundant configuration structures. Moreover, the information sources of the multi-source fusion navigation system have different measurement noise characteristics, so a single detection method cannot meet the requirements of integrity detection at all levels.

In this paper, we propose a multi-level autonomous integrity method of multi-source PNT resilient fusion navigation. Different from other integrity methods using a single fault detection model, we establish multi-level fault detection structure and models for multi-source fusion navigation and introduce a recovery verification model to dynamically adjust the fusion model which can better meet the requirements of future PNT resilient fusion navigation.

Multi-level autonomous integrity monitoring method

Taking INS/GNSS/LBL/USBL fusion navigation in the marine application environment as an example, the implementation process of the multi-level autonomous integrity monitoring method is introduced. The algorithm architecture is shown in Fig. 1, and the pseudocode graph of the multi-level autonomous integrity algorithm is summarized in Fig. 2. Firstly, at the system level and subsystem level, the fault navigation source detection and verification model in "Navigation source fault detection and verification model" section is established to isolate the fault navigation source and verify the non-redundant navigation source (without redundant sensors). Secondly, for the faulty redundant navigation source (with multiple redundant sensors), the sensor fault detection and verification model in "Sensor fault detection and verification model" section is established at the sensor level to isolate the faulty sensors, and the navigation source is reintegrated into the system navigation solution. The sensor that returns to normal will be reintegrated into the solution of the navigation source after verification. Finally, the Protection Level (PL) of the system is calculated with the integrity risk budget in "Calculate the protection levels".

Fig. 1

Architecture diagram of multi-level autonomous integrity monitoring

Fig. 2

Pseudocode graph of the multi-level autonomous integrity monitoring algorithm

Navigation source fault detection and verification model

The multi-source fusion navigation system based on the Kalman filter or the least square method obtained the fusion solution, and the minimum fault unit that can be detected at the system level and subsystem level is the navigation source. Therefore, it is necessary to establish the navigation source fault detection and verification model and reconstruct the fusion model of the system according to the detection results. The KF-LS method is used to solve the multi-source PNT fusion navigation system in this paper.

At present, typical fault detection methods can be summarized into two categories. One is the multi-separation solution method in the location domain (Meng & Hsu, 2021), which constructs fault detection statistics by calculating the differences between the full-viewed solution and the separation solution. This method is affected by redundant measurements, and a certain observation error is submerged in the location solution to reduce the sensitivity of fault detection. The other is the residual method in the measurement domain, which constructs fault detection statistics by calculating the residual Mahalanobis distance of different observed quantities (Parkinson & Axelrad, 1988). This method is difficult to identify and isolate faults. To take advantage of both methods, we design a multi-combination separation residual method to realize the detection and identification of fault navigation sources.

According to the redundancy of navigation sources, subsystems containing different combinations are constructed. Since INS is the reference navigation source of KF fusion, and there are the ways to keep INS reliable, this paper assumes that INS is infallible. Then the subsystems of the INS/GNSS/LBL/USBL multi-source integrated navigation system can be combined in three forms: INS/GNSS/LBL, INS/GNSS/USBL, and INS/LBL/USBL. According to the navigation sources contained in each combination, the separation residual r_k,c and the related covariance matrix ${\mathbf{P}}_{{{\mathbf{r}},k}}^{c}$ in the form of KF-LS are calculated as follows:

$${\mathbf{r}}_{k,c}^{{}} = {\hat{\mathbf{z}}}_{{k,{\text{all}}}}^{{}} - {\hat{\mathbf{z}}}_{k,c}^{{}}$$

(1)

$${\mathbf{P}}_{{{\mathbf{r}},k}}^{c} = {\mathbf{V}}_{k.c}^{{}} + {\mathbf{C}}_{k} ({\mathbf{C}}_{k}^{\rm T} {\mathbf{W}}_{k,c} {\mathbf{C}}_{k} )^{ - 1} {\mathbf{C}}_{k}^{{\text{T}}}$$

(2)

where k is the time epoch, c represents the c-th combination in the subsystem layer, ${\hat{\mathbf{z}}}_{{k,{\text{all}}}}^{{}}$ represents the measurement residual vector under the full navigation source, ${\hat{\mathbf{z}}}_{k,c}^{{}}$ represents the measurement residual vector under the c-th combination, C_k is the measurement matrix, W_k,c is the weight matrix of the c-th combination, and V_k,c is the measurement noise covariance matrix of the c-th combination.

It is known that Mahalanobis distance follows the chi-square distribution with the degree of freedom being the dimension n of the measurement vector (Zheng, 2020). Since the pre-updated residuals are assumed to be zero-mean white noise sequences, the fault detection statistics d_s,c of the separation of residuals Mahalanobis distance by KF-LS and the corresponding threshold T_s are calculated as

$$d_{s,c} = {\mathbf{r}}_{k,c}^{{\text{T}}} ({\mathbf{P}}_{r,k}^{c} )^{ - 1} {\mathbf{r}}_{k,c}$$

(3)

$$T_{s,c} = \chi^{2} (1 - \alpha_{c} ,n) \cdot \beta_{{{\mathbf{r}},k}}^{c}$$

(4)

where α_c is the prior failure probability of the c-the combination, $\beta_{{{\mathbf{r}},k}}^{c}$ is the threshold amplification factor obtained by the trace of the separation residual covariance matrix, and $\chi^{2} (*)$ represents the chi-square calculation function.

When the fault detection statistic d_S is greater than the fault detection threshold T_S, the system has a fault source. If the c-th combination contains the fault navigation source, the measurement residual will be contaminated. When KF is used for fusion estimation of all navigation sources, the residual covariance calculated by Least Square (LS) is also contaminated due to the influence of fault state covariance, so that the two are still consistent. If the c-th combination does not contain the fault navigation source, the calculated residual is not contaminated, but the state covariance contains fault information, so the residual covariance calculated by LS is contaminated. Therefore, if the c-th combination satisfies d_S > T_S, the excluded navigation source is the fault navigation source. For INS/GNSS/LBL/USBL system, the relationship between fault detection results and fault source identification results are shown in Table 1, where 1 represents the fault detection result as d_S > T_S, and 0 represents the fault detection result as d_S < T_S.

Table 1 The relationship between fault detection results and fault source identification results

For the navigation source with multiple redundant sensors, it can isolate the faulty sensor to recover and verify the faulty navigation source. For a non-redundant navigation source system, if the fault sensor is isolated, the location and solution function of the navigation source will be affected. Therefore, only fault navigation sources can be detected and isolated, and the faulty sensor can be recovered by resetting or "heartbeat" restart, which is then verified by the verification model. The w-detection method (Zhang et al., 2019, 2022) is used to verify the consistency of isolated navigation sources in this paper. When multiple navigation sources are faulty, parallel verification can be performed. Firstly, the least squares form containing the state information of the KF main system and the positioning solution information of the navigation source is constructed as

$${\mathbf{Y}}_{k,v} = \left[ {\begin{array}{*{20}c} {{\mathbf{Z}}_{{k,{\text{source}}}} } \\ {{\mathbf{X}}_{{k,{\text{main}}}} } \\ \end{array} } \right] \, {\mathbf{C}}_{k,v} = \left[ {\begin{array}{*{20}c} {{\mathbf{H}}_{{k,{\text{source}}}} } \\ {I_{{k,{\text{main}}}} } \\ \end{array} } \right] \, {\mathbf{V}}_{k,v} = \left[ {\begin{array}{*{20}c} {{\mathbf{R}}_{{k,{\text{source}}}} } & {\mathbf{0}} \\ {\mathbf{0}} & {{\mathbf{P}}_{{k,{\text{main}}}} } \\ \end{array} } \right]$$

(5)

where Z_k,source is the measured values of position and velocity provided by the verification navigation source, R_k,source is the variance matrix of the corresponding measurement values, H_k,source is the KF measurement matrix that needs to verify the navigation source, X_k,main is the estimation state of the fused navigation system, P_k,main is the corresponding error covariance matrix, and 0 is zero matrix.

The w-detection statistics and detection threshold of verified navigation source are as

$$w_{{{\text{source}}}} = \left| {\frac{{{\mathbf{e}}_{v}^{\rm T} {\mathbf{V}}_{k,v} {\mathbf{Y}}_{k,v} }}{{\sqrt {{\mathbf{e}}_{v}^{\rm T} {\mathbf{V}}_{k,v} {\mathbf{P}}_{z,k} {\mathbf{V}}_{k,v} {\mathbf{e}}_{v} } }}} \right|$$

(6)

$$\delta_{{{\text{source}}}} = \nabla {\mathbf{S}}_{v} \sqrt {{\mathbf{e}}_{v}^{\rm T} {\mathbf{V}}_{k,v} {\mathbf{P}}_{z,k} {\mathbf{V}}_{k,v} {\mathbf{e}}_{v} }$$

(7)

where e_v is a unit vector with 1 in the position corresponding to the measurement of the verification navigation source and 0 for the rest, P_z,k is the measurement residual covariance matrix in the least squares form, and $\nabla {\mathbf{S}}_{v}$ is the critical outlier, which depends on the significance level α.

To avoid the influence of a single noise point on recovery judgment, when the w-detection statistic was smaller than the threshold for 5 consecutive times, the navigation source returned to normal and was included in the system fusion calculation.

Sensor fault detection and verification model

For the fault detection of multi-redundant sensors, Jurado et al. (2020) proposed a sliding window residual Mahalanobis distance method based on parallel subfilters to realize fault sensor identification. However, when multiple faults occur at the same time, the parallel subfilters need to be reconstructed and initialized, which leads to the delay of fault detection and affects the localization performance of navigation sources. To solve this problem, based on the fault detection model, the reconstruction and initialization of parallel subfilters are optimized by the expanding dimension matrix, which improves the efficiency of sensor fault detection and recognition.

Assume that there are N_all redundant sensors in the navigation source. When N_f sensors fail simultaneously at time t_k, the number of subfilters J is

$$J = \frac{{N_{{{\text{all}}}} !}}{{N_{f} !(N_{{{\text{all}}}} - N_{f} )!}}$$

(8)

The measurement z_k,j of the j-th subfilter contains the measurement values of multiple sensors. The sum of innovation squares in the sliding window is used as the fault detection statistic for each measurement value. We can judge whether the measurement provided by the sensor contains fault by comparing the relationship between the fault detection statistic and the threshold value. The specific calculation of fault detection statistics is

$${\mathbf{r}}_{k,j}^{{}} = {\mathbf{z}}_{k,j}^{{}} - {\mathbf{H}}_{k,j}^{{}} {\hat{\mathbf{x}}}_{k|k - 1,j}^{{}}$$

(9)

$${\mathbf{P}}_{r,k,j}^{{}} = {\mathbf{R}}_{k,j}^{{}} + {\mathbf{H}}_{k,j}^{{}} ({\mathbf{P}}_{k|k - 1,j}^{{}} )^{ - 1} ({\mathbf{H}}_{k,j}^{{}} )^{\rm T}$$

(10)

$${\mathbf{d}}_{k,j}^{i} = \sum\limits_{t = k - M + 1}^{k} {({\mathbf{r}}_{t,j}^{i} )}^{\rm T} ({\mathbf{P}}_{r,t,j}^{i} )^{ - 1} {\mathbf{r}}_{t,j}^{i}$$

(11)

where i represents the i-th sensor, α is the false detection probability, M is the preset sliding window sampling interval, H_k,j is the observation matrix, ${\hat{\mathbf{x}}}_{k|k - 1,j}^{{}}$ is propagation state estimation, P_k|k-1,j is the prediction error covariance matrix, and R_k,j is the covariance matrix of the measurement noise.

It is known that if no fault, the innovation follows a normal distribution, and the square sum of the innovation follows a chi-square distribution with the degree of freedom being the product of the dimension of ${\mathbf{z}}_{k,j}^{i}$ and time interval. The fault detection threshold $T_{d,j}^{i}$ can be obtained from the chi-square distribution table. The test matrix S_k is constructed to store the fault detection results of the i-th sensor in the j-th subfilter. The value of S_k matrix is

$${\mathbf{S}}_{k} (i,j) = \left\{ \begin{gathered} 0 \, , \, d_{k,j}^{i} \le T_{d,j}^{i} \hfill \\ 0 \, , \, i = j \hfill \\ 1 \, , \, d_{k,j}^{i} > T_{d,j}^{i} \hfill \\ \end{gathered} \right.$$

(12)

The i-th fault sensor will cause the fault of all subfilters including itself. The subfilter that does not include the i-th sensor measurement is not affected. The sensor detection results contained in the j-th subfilter are added together, and the score vector S_all of each subfilter is constructed as

$${\mathbf{S}}_{{{\text{all}}}} \left( j \right) = \sum\limits_{f = 1}^{{N_{{{\text{all}}}} - N_{f} }} {{\mathbf{S}}_{k} (f,j)} \, j = 1,2,...,J$$

(13)

The fault is handled according to the zero and non-zero values in the S_all. If S_all is a zero vector, there is no sensor fault. If there is a unique zero value in S_all, the sensor excluded by the subfilter corresponding to the zero value is the faulty sensor. If S_all is a non-zero matrix and contains multiple zero values at the same time, there is a fault in the sensor, which cannot be identified. In this case, the sliding window interval needs to increase. If there is no zero value in S_all, it is necessary to increase the number of hypothetical simultaneous faults, and then perform fault detection again.

To solve the problem of the detection delay caused by the reconstruction of parallel subfilters, the fault detection model is initialized by the dimension-expanding matrix. Taking 5 sensors as an example, the construction process of the dimension-expanding matrix under different fault number is shown in Fig. 3. In Fig. 3, 1–5 represents the sensor serial number, the green rectangle represents the combination of subfilters under the current fault assumption, the blue rectangle represents the composition of the dimension-expanding matrix, and the red rectangle represents the example case which has the same combination. By adding and averaging the detection statistics with the same combination in the dimension-expanding matrix, the initial detection value of the corresponding combination of the new subfilter is set.

Fig. 3

Dimension-expanding matrix construction from single fault to multiple faults

As can be seen in Fig. 3, by fusing the fault detection statistics of the same sensor combination in the dimension-expanding matrix (as shown in the red box), the initial value of the fault detection statistics of the new subfilter is calculated as

$$E(j,s) = \left\{ {d_{k - M + 1:k}^{[i,j]} } \right\} \, i,s = 1,2,...,N_{{{\text{all}}}} - N_{{f,{\text{old}}}} \& i \ne s$$

(14)

$$d_{k - M + 1:k}^{{[j_{{{\text{new}}}} ]}} = \frac{{\sum\limits_{{{\mathbf{A}}_{e} = {\mathbf{A}}_{j} }} {E(j,s)} }}{{N_{{f,{\text{new}}}} }} \, j = 1,2,...,J,s = 1,2,...,N_{{{\text{all}}}} - N_{{f,{\text{old}}}}$$

(15)

where N_f,old and N_f,new represent the number of simultaneous faults before and after adjustment, respectively, j_new represents the serial number of the new level subfilters, A_e represents the sensor combination of the dimension-expanding matrix E(j,s), A_j represents the sensor combination of the j-th subfilter of the new level, d represents fault detection statistics for different subfilters, and M represents the sliding window interval.

The sensor fault detection model will isolate the faulty sensor to ensure the integrity of the navigation solution. However, the isolation sensor can ensure the reliability of the navigation solution, but it reduces the redundant information of the navigation source. When the number of effective sensors is smaller than the observability requirement of the navigation system, the system will be unable to provide the navigation solution (Hein, 2020). In addition, if the additional sensor is directly incorporated into the navigation solution without verification, the current navigation solution may be affected by an initial fault. Therefore, when the isolated sensor returns to normal or an additional sensor is available, the sensor needs to be verified before incorporated into the navigation solution. Therefore, a real-time verification model is designed, and a verification subfilter based on the current main filter is constructed to verify untrusted sensors.

The verification model works periodically when there are untrusted sensors in the system. The verification subfilter is initialized with the main filter parameters at the current moment. The observation model of the verification subfilter consists of two parts: one is the measurement value of the effective sensor at the current moment, and the other is the measurement value provided by the sensor to be verified. The specific measurement model is

$${\mathbf{z}}_{{k,{\text{vaild}}}} = \left[ {\begin{array}{*{20}l} {{\mathbf{z}}_{{k,{\text{vaild}}}} } \hfill \\ {{\mathbf{z}}_{{k,{\text{sensor}}}} } \hfill \\ \end{array} } \right] = \left[ {\begin{array}{*{20}l} {{\mathbf{H}}_{{k,{\text{vaild}}}} } \hfill \\ {{\mathbf{H}}_{{k,{\text{sensor}}}} } \hfill \\ \end{array} } \right]{\mathbf{x}}_{k|k - 1} + \left[ {\begin{array}{*{20}l} {{\mathbf{v}}_{{k,{\text{vaild}}}} } \hfill \\ {{\mathbf{v}}_{{k,{\text{sensor}}}} } \hfill \\ \end{array} } \right]$$

(16)

where k represents the time epoch, vaild represents the effective sensor, and sensor represents the sensor to be verified.

The performance of the sensor is evaluated by collecting the measurement residuals of the verification sensor in the validation stage to construct a verification statistic. The measurement residuals, covariance matrix, and validation detection statistic of the validation sensor are described as follows.

$${\mathbf{r}}_{k,v} = {\mathbf{z}}_{{k,{\text{sensor}}}} - {\mathbf{H}}_{{k,{\text{sensor}}}} {\hat{\mathbf{x}}}_{k}$$

(17)

$${\mathbf{P}}_{k,v} = {\mathbf{R}}_{k,v} + {\mathbf{H}}_{{k,{\text{sensor}}}} {\mathbf{P}}_{k} {\mathbf{H}}_{{k,{\text{sensor}}}}^{{\text{T}}}$$

(18)

$$d_{v} = \sum\limits_{t = k}^{{k + M_{v} }} {{\mathbf{r}}_{t,v}^{{\text{T}}} {\mathbf{P}}_{t,v}^{ - 1} {\mathbf{r}}_{t,v} }$$

(19)

where R_k,v is the measurement noise covariance matrix, H_k,sensor is the measurement matrix,${\hat{\mathbf{x}}}_{k}$ is the state estimation value of the verification subfilter, P_k is the state error covariance matrix, and M_v is the verification period.

In the verification stage, if d_v satisfies the chi-square distribution the verified sensor is reliable and reincorporated into the navigation solution system. Otherwise, the sensor is unreliable and waits for the next verification period to reverify. In addition, it is necessary to adjust the sensor fault detection model when the verified sensors are incorporated into navigation source calculations. To avoid the influence on the subfilter which is undergoing fault detection, we use the dimension-expanding matrix to assign the detection statistic.

Calculate the Protection Levels

Protection Level (PL), as one of the indicators of integrity, is the limit of position error allowed by the system when an undetected fault occurs in the navigation system. PL is an error bound calculated to ensure that the probability of position error exceeding the alarm limit is less than or equal to the target integrity risk probability. Therefore, the integrity risk corresponding to the protection level (Zhai et al., 2020) can be defined as

$$P\left( {\Delta x > \zeta _{{{\text{AL}}}} \& \zeta _{{{\text{PL}}}} < \zeta _{{{\text{AL}}}} } \right) \le {\text{I}}_{{{\text{REQ}}}}$$

(20)

where Δx is the error of the estimated position with respect to the real position, $\zeta_{{{\text{PL}}}}$ is the protection level, $\zeta_{{{\text{AL}}}}$ is the position error alarm limit, and $I_{{{\text{REQ}}}}$ is the integrity risk probability required by the system.

If n navigation sources participating in the fusion solution are independent of each other, the number of combinations including the fault-free hypothesis and the fault hypothesis is $n_{S} = 2^{n}$. The integrity risk of the multi-source integrated navigation system can be considered as a set of mutually exclusive assumptions, then the occurrence probability of some fault combinations is less than the integrity risk required by the system, so it does not need to be monitored. Set $\Theta$ as the minimum number of simultaneous fault navigation sources that must be monitored, then the faulty assumptions can be divided into two groups: one is the fault number exceeding $\Theta$(mark as > $\Theta$), and the other is all other faults (mark as ≤ $\Theta$). The integrity risk of the system is

$$P_{{{\text{HMI}}}} = P(A_{{{\text{HMI}}}} | \le \Theta )P_{ \le \Theta } + P(A_{{{\text{HMI}}}} | > \Theta )P_{ > \Theta }$$

(21)

where P_HMI represents the probability of Hazardously Misleading Information A_HMI occurring in the system.

By making $P_{ > \Theta }$ less than the integrity risk $I_{{{\text{REQ}}}}$ required by the system, the minimum number of simultaneous failures required for monitoring multi-source fusion navigation can be obtained. The prior probability of $P_{ > \Theta }$ is

$$P_{ > \Theta } = \sum\limits_{n = \Theta + 1}^{{n_{S} }} {C_{n}^{{n_{S} }} P_{{{\text{nav}}}}^{n} (1 - P_{{{\text{nav}}}} )^{{n_{S} - n}} }$$

(22)

where $C_{n}^{{n_{S} }}$ is the binomial coefficient, and P_nav is the prior fault probability of a single navigation source.

Make $P(A_{{{\text{HMI}}}} | > \Theta )$ equal to the upper limit to obtain a strict integrity boundary. For the other faults satisfying ≤ $\Theta$, there are h + 1 separate fault hypothesis, where h is calculated as

$$h = \sum\limits_{n = 1}^{\Theta } {C_{n}^{\Theta } }$$

(23)

Let H₀ represent the fault-free hypothesis and H_m (m = 1,2,…,h) represent the fault hypothesis. Then the integrity risk is further simplified as

$$\sum\limits_{m = 0}^{h} {P(A_{{{\text{HMI}}}} |H_{m} )P(H_{m} ) + P_{ > \Theta } } < I_{{{\text{REQ}}}}$$

(24)

For the satellite navigation system, the ARAIM algorithm report gives a clear value of the integrity risk probability, and the prior fault probability of each satellite is equal. While for the multi-source integrated navigation system, the prior fault probability of each navigation source is not the same, and the integrity risk probability that the system can meet is also different under different fault assumptions. Therefore, we need to dynamically adjust the fault hypothesis to be monitored according to the actual effective navigation source.

If h = 3 is the maximum system fault without considering INS faults for INS/GNSS/USBL/LBL systems, the fault hypothesis h = 2 should be monitored because fault detection can be realized with a certain amount of redundancy. At present, there is no clear explanation for the prior fault probability of each navigation source. According to the existing literature (Juan et al., 2009), the prior fault probability of the GNSS navigation source is set to 1 × 10^–4, the USBL navigation source is set to 1 × 10^–5, and the LBL navigation source is set to 1 × 10^–4.

Set the total system integrity risk requirement to 1 × 10^–7. The integrity risk dynamic monitoring tree is established under different fault assumptions and subsystem level combinations, as shown in Fig. 4, where red is the combination that does not need to be monitored, and blue is the combination that needs to be monitored. Under the fault hypothesis h = 2, not all combination conditions need to be monitored. Therefore, we dynamically adjust the fault subset that needs to be monitored according to the actual situation of multi-source fusion navigation.

Fig. 4

Fault assumptions and combinations that need to be monitored

The state estimation of separation combination c is described as

$${\hat{\mathbf{x}}}_{k,c} = {\mathbf{S}}_{k,c} {\mathbf{z}}_{k,c}$$

(25)

where S_c is the pseudo-inverse of the observation matrix ${\mathbf{S}}_{c} = \left( {{\mathbf{C}}_{k}^{{\text{T}}} {\mathbf{V}}_{k,c}^{ - 1} {\mathbf{C}}_{k} } \right)^{ - 1} {\mathbf{C}}_{k}^{{\text{T}}} {\mathbf{V}}_{k,c}^{ - 1}$.

The state estimation error of separation combination c is described as

$${\updelta }{\mathbf{x}}_{k,c} = {\hat{\mathbf{x}}}_{k,c} - {\mathbf{x}}_{k,c} = {\mathbf{S}}_{k,c} \left( {{\mathbf{v}}_{k,c} + {\mathbf{f}}_{k,c} } \right)$$

(26)

where v_k is the measurement noise and f_k is the fault vector.

It should be noted that in the process of multi-source fusion, the position error is often defined as the state, so the real position error x_k,c is described as

$${\mathbf{x}}_{k,c} = {\mathbf{B}}_{k} {\mathbf{z}}_{k,c} - {\mathbf{B}}_{k} ({\mathbf{v}}_{k,c} + {\mathbf{f}}_{k,c} )$$

(27)

where ${\mathbf{B}}_{k} = ({\mathbf{C}}_{k}^{{\text{T}}} {\mathbf{C}}_{k} )^{ - 1} {\mathbf{C}}_{k}^{{\text{T}}}$.

Position error is mainly affected by state estimation error, measurement noise, and measurement fault. Therefore, the formula for calculating the protection level of separation combination c is described as

$$\zeta_{{{\text{PL}},k}}^{c} = {\mathbf{B}}_{k} {\mathbf{z}}_{k,c} + K_{{{\text{md}}}} \sigma_{p,c} + \ell_{{{\text{max}},c}} (T_{s,c} /\beta_{r,k}^{c} )$$

(28)

$$\ell_{{{\text{max}},c}}^{2} = \frac{{\mu_{k,c}^{2} }}{{\lambda_{k,c}^{2} }} = \frac{{{\mathbf{f}}_{k,c}^{{\text{T}}} {\mathbf{S}}_{k,c} {\mathbf{S}}_{k,c}^{{\text{T}}} {\mathbf{f}}_{k,c} }}{{{\mathbf{f}}_{k,c}^{{\text{T}}} {\mathbf{V}}_{k,c}^{ - 1} ({\mathbf{I}} - {\mathbf{C}}_{k} {\mathbf{S}}_{k,c} ){\mathbf{f}}_{k,c} }}$$

(29)

where K_md is the risk factor calculated by the probability of missing detection, σ_p,c is the standard deviation of the state error, and $\ell_{\max ,c}$ is the slope in the worst case. The detection threshold in the measurement domain is projected into the position domain according to the ratio of the square of the mean position error brought by the fault vector in the worst case to the non-central parameter of the detection statistic.

The combined navigation system can contain multiple separation combinations when the fault assumption h = m. The calculated protection level $\zeta_{{{\text{PL}},k}}^{c}$ of each combination reflects the position error under the current fault hypothesis, and the maximum value is selected as the protection level $\zeta_{{{\text{PL}},m}}^{{}}$ under the fault hypothesis.

The integrity risk probability is equal to the product of the probability of fault hypothesis occurrence and the probability of missing detection (Zhang et al., 2022). Based on Eq. (28), the integrity risk of the multi-source integrated navigation system can be further expressed as

$$2P(H_{0} )Q\left( {\frac{{\zeta_{{{\text{PL}},0}} }}{{\sigma_{0} }}} \right) + \sum\limits_{m = 1}^{h} {P(H_{m} )Q\left( {K_{{{\text{md}}}}^{{}} } \right)} \le I_{{{\text{REQ}}}}$$

(30)

$$2P(H_{0} )Q\left( {\frac{{\zeta_{{{\text{PL}},0}} }}{{\sigma_{0} }}} \right) + \sum\limits_{m = 1}^{h} {P(H_{m} )Q\left( {\frac{{\zeta_{{{\text{PL}},m}} - \ell_{\max ,m} (T_{s,m} /\sigma_{r,k}^{m} ) - B_{k} z_{k,m} }}{{\sigma_{p,m} }}} \right)} \le I_{{{\text{REQ}}}}$$

(31)

where $\zeta_{{{\text{PL}},0}}$ represents the protection level in the case of no fault and σ₀ is the standard deviation of the estimated position without fault.

The protection level can be obtained by solving Eq. (31), but it is a complicated process to accurately solve the above inequality. We use the half interval search method proposed in the ARAIM baseline algorithm to calculate the protection level (Blanch & Walter, 2021; Martin, 2020).

Results and analysis

In the ocean scene, the INS/GNSS/LBL/USBL multi-source integrated navigation system is formed by simulating the experimental data of LBL and USBL according to the measured INS and GNSS data on board, and the autonomous integrity monitoring method proposed in this paper is tested. The true trajectory is shown in Fig. 5, where the start and end positions are marked with a red dot and blue triangle, respectively. The parameters of the simulation model, including gyro/accelerometer error, GNSS pseudorange error, beacon error, and integrity settings, are shown in Table 2. The initial 200 s data is selected from the long trajectory data as the experimental test data. The positioning error curve and fault detection statistics curve under the fault free condition are shown in Figs. 6 and 7 respectively, and the positioning performance statistics under the fault-free condition are shown in Table 3.

Fig. 5

The true trajectory

Table 2 Simulation parameter

Fig. 6

Positioning error curve

Fig. 7

Fault detection statistics curve

Table 3 Positioning performance under the fault-free condition

At different epochs, the measured values of different navigation sensors are added with a constant bias and gradual increase fault respectively. These faults are used to verify the fault detection capability of the multi-level autonomous integrity method proposed in this paper. The specific fault description is shown in Table 4.

Table 4 The specific description of the added faults

A single sensor gradual increase fault and double sensor constant bias are respectively added to the measurements of GNSS and LBL, and gradual increase fault and constant bias are respectively added to different sensors for navigation source USBL. Since GNSS and LBL are multi redundant navigation systems, the sensor level fault detection can be performed after the fault navigation source is detected. The USBL is a non-redundant navigation system, the faulty sensor can be recovered by "heartbeat" restart and determine whether the USBL navigation source is restored to normal by verifying the recovery algorithm. The statistics of detection results under different cases are shown in Table 5, where Cases 1–4 provide the verification of fault sensors and Cases 5–6 provide the verification of fault navigation sources. The fault detection statistics curve and positioning error curve are shown in Fig. 8.

Table 5 The statistics of detection results under different fault cases

Fig. 8

The fault detection statistics curve and positioning error curve

From Fig. 8, when the system contains a fault navigation source, the test statistics curve of the combination without the fault navigation source significantly increases and quickly exceeds the threshold. If it is not isolated, the positioning error curve will also increase, affecting the accuracy of the fusion navigation. If it is isolated, the positioning error curve will remain the normal accuracy range. And from Table 5, the navigation source fault detection model can detect and isolate the constant bias and gradual increase fault of GNSS, LBL and USBL within 5 s. Compared with RMSE values without FDI, the RMSE values in the north direction with FDI decreased by 0.03 m, 0.28 m, 0.15 m, 1.49 m, 0.03 m and 0.07 m, respectively, which guaranteed the positioning accuracy.

The fault sensors are detected and isolated by the sensor fault detection model for GNSS and LBL faults, and the isolated sensors are verified in real-time. To verify the performance of sensor fault detection, the positioning error curves with Sensor Fault Detection and Isolation (SFDI) and without SFDI of Case 1 ~ Case 4 in Table 4 are shown in Fig. 9. The RMSE of position errors in the fault period is shown in Table 6.

Fig. 9

Sensor level positioning error curve

Table 6 The RMSE of position within the fault period

From Table 4 and Table 5, even though the navigation source is still in the fault time epoch, GNSS and LBL can still participate in the positioning solution because they isolate the fault sensor through the sensor fault detection model. Figure 9 tells that for the GNSS system and LBL system, compared to the navigation source fault detection model, the sensor fault detection model can effectively reduce the positioning error and improve the accuracy of the navigation system by isolating the faulty sensors inside the navigation system and reincorporating the navigation source into the solution.

The all values of RMSE in Table 6 are reduced by 0.11 m, 0.12 m, 0.11 m and 0.18 m, respectively. In addition, the sensor level verification mode can verify the isolated sensors. After the fault duration, the fault sensors pass the verification and can be reincorporated into the navigation source. The verification method can increase the redundancy of the navigation source itself and improve the detection ability of the fault sensor.

In addition, to verify the usefulness of the dimension-expanding matrix in multi-sensor fault detection, the original method proposed by Jurado et al. (2020) and the optimized method proposed in this paper are used to detect multi-satellite faults in Case 2. The difference between fault detection time and fault identification time with the two methods is 10 s and 0.5 s, respectively. The position error comparison curve is shown in Fig. 10. When there are two faulty satellites at the same time, the original method has large position error of the GNSS system due to the detection delay caused by the reinitialization. And the optimized method using the dimension expanding matrix can quickly isolate faulty sensors and restore the normal positioning function of the GNSS system. This is beneficial for GNSS to pass verification and be reincorporated into the system solution as soon as possible.

Fig. 10

Position error comparison curve of GNSS navigation solution

To verify the system level Verification Recovery Function (VRF), the verification statistics curve and the position error curve for Case 5 are shown in Figs. 11 and 12 respectively. From Fig. 11, the established validation statistics can effectively reflect whether the non-redundant navigation system USBL still contains faults. When USBL returns to normal, its validation statistics remains below the threshold. In addition, from Fig. 12, compared to the system without VRF, the positioning error curve of the system with VRF is reduced when the USBL passes verification and reincorporates into system solution.

Fig. 11

Verification statistics curve

Fig. 12

The positioning error curve

In addition, to verify the advantages of the multi-combination separation residual method based on KF-LS proposed in this paper, it is compared with the traditional KF-LS multi solution separation method. The constant biases of 10 m and 20 m are added to a GNSS satellite and tested with the traditional method and the method proposed in this paper. At the initial fault time, we plotted the errors in the north-down directions and the fault detection statistics of the total solution and the three separated solutions in Fig. 13.

Fig. 13

The fault detection statistics with different methods

From Fig. 13, for the constant bias fault of 10 m, the position error is within the threshold circle, so the traditional method cannot detect the fault. The fault detection statistics with the method proposed in this paper can still effectively reflect anomalies and distinguish fault navigation sources. For the constant bias fault of 20 m, both methods can effectively detect the fault. However, for the traditional method, it is necessary to design the thresholds for each direction, and the method proposed in this paper can detect faults only by using a threshold value.

For the integrity detection of the multi-source fusion navigation system, the protection level of the fusion system needs to be calculated. When a missing detection occurs, the system must send an alarm in time to ensure integrity. Taking Case 4 in Table 4 as an example, Fig. 14 shows the protection level curves with and without the fault isolated.

Fig. 14

System protection level curve

From Fig. 14, the Horizontal Protection Level (HPL) and Vertical Protection Level (VPL) of the system are about 3.1 m and 2.7 m after it is stabilized. When the LBL is faulty, but the navigation source is not isolated in time, the system protection level increases significantly. In Fig. 14b, an obviously large protection level exists in the initial stage of fault detection. This is because to prevent the influence of outlier points, continuity judgment is set in this paper, that is, when the statistics of two consecutive fault detection are greater than the threshold, the system will isolate the fault navigation source. After the system correctly isolates the LBL fault navigation source, the protection level is within the normal range in the fault duration.

Conclusions

A multi-level autonomous integrity monitoring method is proposed for the multi-source PNT resilient fusion navigation system. Firstly, a navigation source fault detection model based on multiple combination separation residual method is designed to detect and isolate fault navigation sources. And a system level verification model is built to verify the isolated non-redundant navigation sources in real-time. After successful verification, the isolated navigation sources can be included in the multi-source fusion solution. Secondly, the sensor level fault detection model is optimized by using the dimension-expanding matrix, which can effectively solve the detection delay problem of multiple fault sensors within the navigation source. The isolated sensors are verified in real-time. If the sensors return to normal, they are included in the positioning calculation of the navigation source, and the system fusion model is reconstructed. Finally, based on the integrity dynamic monitoring tree structure, the integrity risk budget is allocated to the fault assumption and the system protection level is calculated.

Based on the INS/GNSS/LBL/USBL multi-source fusion navigation, different types of faults are set, and simulation tests are carried out. The navigation source fault detection model proposed in this paper can detect constant biases and slowly growing faults quickly and is more sensitive to detect small faults. By optimizing the sensor-level fault detection model, the fault navigation source can be recovered quickly, the redundancy of the system is maintained, and the fault detection capability is enhanced. Our future work will focus on improving the fault detection capability and building a real verification platform and verifying the feasibility of the proposed algorithm in different scenarios. In addition, the realization of the resilient integrity monitoring of the multi-source PNT navigation system in different scenarios is another important research area.